[Libreoffice-commits] core.git: Branch 'distro/lhm/libreoffice-6-4+backports' - sc/source

[Caolán McNamara (via logerrit)]

 sc/source/core/tool/compiler.cxx |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

New commits:
commit 2712cb94f6c25ea974ee10c503deba25061a7a6a
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Apr 2 14:28:37 2021 +0100
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Tue Nov 16 10:34:36 2021 +0100

    ofz: Segv on unknown address
    
    Change-Id: I6c69375a89781fc0b87230203335c861efb562f9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113518
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 8de38977838d5a044271cb170730e3d557659f17)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125236
    Tested-by: Michael Stahl <michael.st...@allotropia.de>
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx
index e26dd00177f9..84a0d64e155b 100644
--- a/sc/source/core/tool/compiler.cxx
+++ b/sc/source/core/tool/compiler.cxx
@@ -2588,7 +2588,14 @@ Label_MaskStateMachine:
                                 if (eState != ssSkipReference)
                                 {
                                     *pSym++ = c;
-                                    *pSym++ = *pSrc++;
+
+                                    if( pSym == &cSymbol[ MAXSTRLEN ] )
+                                    {
+                                        SetError( 
FormulaError::StringOverflow);
+                                        eState = ssStop;
+                                    }
+                                    else
+                                        *pSym++ = *pSrc++;
                                 }
                                 bAddToSymbol = false;
                             }